The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)
kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling (CVE-2026-98974)
Bug Fix(es) and Enhancement(s):
Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.9.z] (JIRA:Rocky Linux-254109)
Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-9.9] (JIRA:Rocky Linux-174325)
[Rocky Linux-9.9] gfp: include __GFP_NOWARN in GFP_NOWAIT (JIRA:Rocky Linux-249621)
gfs2: Get rid of sd_async_glock_wait [rhel-9.9.z] (JIRA:Rocky Linux-254079)
TLS-related kernel panics in kernel-5.14.0-741.10.1.el9_9 and higher (JIRA:Rocky Linux-283336)
Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.9.z] (JIRA:Rocky Linux-291353)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:97873"
}